Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f929c53 authored by Svetoslav Ganov's avatar Svetoslav Ganov
Browse files

Don't allow permission change to runtime 

Prevent apps to change permission protection level to dangerous
from any other type as this would allow a privilege escalation
where an app adds a normal permission in other app's group and
then redefines it as dangerous leading to the group auto-grant.

Test: Added a CTS test which passes.

bug:33860747

Change-Id: I1ccf546f78ee79ff027cb98124be81c8e5265a82
parent 0396cde3

services/core/java/com/android/server/pm/PackageManagerService.java

+21 −0
Original line number Diff line number Diff line
@@ -15611,6 +15611,27 @@ public class PackageManagerService extends IPackageManager.Stub { 
                        return;

                    }













                    // Prevent apps to change permission protection level to dangerous













                    // from any other type as this would allow a privilege escalation













                    // where an app adds a normal/signature permission in other app's













                    // group and later redefines it as dangerous leading to the group













                    // auto-grant.













                    final int permissionCount = pkg.permissions.size();













                    for (int i = 0; i < permissionCount; i++) {













                        PackageParser.Permission permission = pkg.permissions.get(i);













                        if ((permission.info.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE)













                                == PermissionInfo.PROTECTION_DANGEROUS) {













                            BasePermission bp = mSettings.mPermissions.get(permission.info.name);













                            if (bp != null && !bp.isRuntime()) {













                                res.setError(PackageManager.INSTALL_PARSE_FAILED_BAD_MANIFEST,













                                        "Package " + pkg.packageName + " trying to change a "













                                                + "non-runtime permission " + permission.info.name













                                                + " to runtime.");













                                return;













                            }













                        }













                    }



























                    // Prevent installing of child packages















                    if (oldPackage.parentPackage != null) {















                        res.setError(PackageManager.INSTALL_PARSE_FAILED_BAD_PACKAGE_NAME,